This in fact is a powerful attack method that needs only predicted labels from the target (like Boundary and HopSkipJump) but requires much fewer queries. Once the substitute is trained it can produce adversaries for any input. Recent advances in transferability have made this method more effective and broken defenses based on adversarial training [1]}, [2]}. For the substitute model we use a three layer sigmoid activated cross-entropy loss network with 200 nodes in each hidden layer. We start with 200 random test data points from which we iteratively train the substitute model with augmented adversaries.
